Organisations depend on networks, websites, cloud platforms, mobile applications, connected devices, and employees to deliver essential services. Each part of this environment can introduce weaknesses that an attacker may attempt to exploit.
Penetration testing helps organisations identify those weaknesses before they lead to data theft, operational disruption, financial loss, or reputational damage. However, no single penetration test can assess every system or attack scenario equally.
The main types of penetration testing can be grouped in two ways:
- By how much information the tester receives
- By the system, environment, or people being assessed
Understanding these categories helps organisations select the right assessment for their infrastructure, risk profile, and security objectives.
This article explains the principal types of pen testing, how they differ, and when each method is most appropriate.
What Is Penetration Testing?
Penetration testing is an authorised security assessment in which qualified testers attempt to identify and exploit vulnerabilities in a system, application, device, or network.
Penetration testers, also known as ethical hackers, use many of the same penetration testing techniques as malicious attackers. However, they operate within an agreed scope and with legal permission.
A penetration test may determine:
- Whether unauthorised access is possible
- Which systems or data could be reached
- Whether privileges can be increased
- How far an attacker could move through the environment
- Whether security controls detect the activity
- What business impact successful exploitation could cause
A penetration test is a point-in-time assessment. It shows how the environment resisted specific attack methods during a defined period. It does not guarantee that the organisation will remain secure after systems, applications, or configurations change.
Penetration Testing Versus Vulnerability Scanning
Penetration testing and vulnerability scanning are related, but they are not the same activity.
A vulnerability scan uses automated tools to identify known weaknesses, missing patches, exposed services, and insecure configurations.
A penetration test goes further by attempting to validate and exploit selected weaknesses. It combines automated tools with manual analysis, technical judgement, and adversarial thinking.
| Vulnerability scanning | Penetration testing |
| Primarily automated | Manual and automated |
| Identifies potential weaknesses | Tests practical exploitability |
| Provides broad coverage | Examines defined targets in depth |
| May produce false positives | Demonstrates potential impact |
| Suitable for regular monitoring | Conducted as a controlled engagement |
Both activities are valuable. Vulnerability scanning can identify changing exposures between formal penetration tests, while penetration testing demonstrates how weaknesses could be used in a real attack.
Black Box, White Box, and Grey Box Testing
The first way to categorise the methods of penetration testing is according to how much information the tester receives.
Black Box Penetration Testing
In a black box test, the tester receives little or no internal information about the target.
They may begin with only the organisation’s name, public domains, internet addresses, and information available through open sources.
The tester must discover possible entry points in much the same way as an external attacker.
Black box testing is useful for assessing:
- Publicly exposed systems
- External network defences
- Information available online
- Internet-facing applications
- Perimeter security controls
Its principal advantage is realism. It demonstrates what an attacker without legitimate access could discover and exploit.
However, a considerable part of the engagement may be spent gathering information. The tester may therefore have less time to examine individual systems in depth.
A double-blind test is a more advanced variation in which most of the organisation’s security team does not know when the assessment will occur. This can test real-time detection and incident response, but it requires careful planning.
White Box Penetration Testing
In a white box test, the tester receives extensive information and access.
This may include:
- Source code
- Credentials
- Network maps
- Architecture diagrams
- Cloud configurations
- Application documentation
- Details of security controls
White box testing allows the tester to examine systems in greater depth without spending time discovering information that the organisation can provide directly.
It is useful for:
- Detailed application testing
- Code and logic review
- Internal network assessment
- Privileged access testing
- Cloud configuration analysis
- Identifying hidden weaknesses
White box testing provides greater technical coverage, but it does not fully reproduce the uncertainty faced by an external attacker.
Grey Box Penetration Testing
A grey box test gives the tester partial information or limited access.
The tester may receive a standard user account, selected documentation, or basic details about the environment.
This approach can simulate:
- A compromised employee account
- An attacker with limited internal knowledge
- A customer attempting to exceed authorised access
- An insider with restricted privileges
Grey box testing provides a balance between black box realism and white box depth. It is commonly used for web applications, cloud environments, customer portals, and internal systems.
Network Penetration Testing
Network penetration testing examines the infrastructure that allows systems and devices to communicate.
Targets may include:
- Servers
- Routers
- Switches
- Firewalls
- Workstations
- Virtual private networks
- Remote-access services
- Network-management interfaces
Testing may identify:
- Missing security patches
- Weak protocols
- Exposed administrative services
- Insecure configurations
- Poor network segmentation
- Weak credentials
- Excessive permissions
- Vulnerable services
External Network Testing
An external network test examines systems accessible from the internet.
It may assess public internet addresses, firewalls, remote-access systems, email infrastructure, and other externally exposed services.
The purpose is to show what an attacker outside the organisation could discover and exploit without first gaining internal access.
Internal Network Testing
An internal network test examines what could happen after an attacker gains an initial foothold.
This could represent:
- A compromised employee account
- An infected device
- A malicious insider
- An unauthorised visitor
- A compromised supplier connection
The tester may attempt to move between systems, increase privileges, and access sensitive data.
Internal testing is particularly useful for assessing segmentation, identity controls, privileged access, and the potential impact of ransomware or account compromise.
Application Penetration Testing
Application penetration testing examines software used by customers, employees, and business partners.
It includes web, mobile, API, and client-side testing.
Web Application Penetration Testing
Web application testing examines websites, portals, e-commerce platforms, and browser-based software.
Common weaknesses include:
- Broken access control
- Injection vulnerabilities
- Cross-site scripting
- Weak authentication
- Insecure session management
- Sensitive data exposure
- Insecure file uploads
- Business-logic flaws
Business-logic testing is especially important. Automated tools may identify technical vulnerabilities, but they may not recognise that a user can bypass an approval process, manipulate a transaction, or access another customer’s information.
Mobile Application Penetration Testing
Mobile application testing assesses applications developed for platforms such as Android and iOS.
The assessment may cover:
- Authentication and authorisation
- Local data storage
- Session management
- Encryption
- Backend services
- Hard-coded secrets
- Application programming interfaces
The test should usually consider both the application installed on the device and the systems with which it communicates.
API Penetration Testing
Application programming interfaces allow systems and applications to exchange information.
API testing may identify:
- Broken authorisation
- Weak authentication
- Excessive data exposure
- Inadequate rate limiting
- Injection vulnerabilities
- Unrestricted resource consumption
- Insecure integrations
APIs are important testing targets because they may provide direct access to sensitive data and business functions.
Client-Side Penetration Testing
Client-side testing examines software running on an employee’s or customer’s device.
Targets may include web browsers, email clients, office software, document readers, and desktop applications.
The assessment determines whether malicious websites, documents, files, or links could compromise the user’s device or session.
Cloud Penetration Testing
Cloud penetration testing assesses applications, data, identities, services, and configurations hosted within cloud platforms.
The test may examine:
- Identity and access management
- Exposed storage
- Excessive permissions
- Insecure APIs
- Network configuration
- Secrets management
- Workload isolation
- Logging and monitoring
- Misconfigured cloud services
Cloud environments follow a shared-responsibility model. The cloud provider protects the underlying infrastructure, while the customer remains responsible for areas such as its data, users, applications, permissions, and configurations.
Cloud tests are often conducted using grey box or white box methods because authorised accounts and configuration information are required.
Testing must also comply with the cloud provider’s security policies and remain limited to assets controlled by the organisation.
Wireless Penetration Testing
Wireless penetration testing examines Wi-Fi networks and connected wireless devices.
The tester may assess:
- Wireless encryption
- Authentication controls
- Access-point configuration
- Rogue access points
- Guest networks
- Network segmentation
- Weak or shared credentials
- Connected devices
Wireless testing normally requires the tester to be within signal range and may therefore be performed on-site.
A compromised wireless network can allow an attacker to bypass external perimeter controls. Separation between guest, corporate, and sensitive networks is therefore important.
Internet of Things Penetration Testing
Internet of Things testing examines connected devices and their supporting systems.
The scope may include:
- Hardware
- Firmware
- Mobile applications
- Cloud services
- APIs
- Wireless communication
- Data storage
- Update processes
Common weaknesses include default credentials, insecure communications, outdated firmware, exposed interfaces, and weak access controls.
Because IoT products combine hardware, software, networks, and cloud services, testing may require several specialist skills.
Social Engineering Penetration Testing
Social engineering testing assesses whether attackers can manipulate employees or suppliers into disclosing information or taking unsafe actions.
Methods may include:
- Phishing emails
- Voice phishing
- Text-message phishing
- Impersonation
- Fraudulent payment instructions
- Requests for credentials
- Business email compromise scenarios
The purpose is not to punish employees. It is to assess whether awareness training, verification procedures, reporting channels, and organisational controls work under realistic conditions.
Testing should be carefully authorised and designed to avoid unnecessary distress or damage to employee trust.
Physical Penetration Testing
Physical penetration testing assesses whether an attacker could bypass physical controls and enter restricted areas.
The tester may examine:
- Doors and locks
- Access badges
- Reception procedures
- Visitor management
- Cameras
- Alarms
- Server rooms
- Tailgating controls
Successful physical access could allow an attacker to steal equipment, connect an unauthorised device, access an unlocked workstation, or interfere with critical infrastructure.
The rules of engagement must define which locations, techniques, and personnel are within scope.
Red Teaming, Blue Teaming, and Purple Teaming
Red teaming is a broader adversarial exercise that assesses how well an organisation can prevent, detect, and respond to a realistic attack.
A red team may combine:
- Network attacks
- Application exploitation
- Social engineering
- Physical intrusion
- Identity compromise
- Cloud attacks
A standard penetration test normally identifies and validates vulnerabilities within a defined scope. A red-team exercise focuses more heavily on achieving agreed objectives while avoiding detection.
The blue team consists of the organisation’s defenders. It attempts to detect, investigate, and contain the red team’s activity.
Purple teaming combines the two approaches. Offensive and defensive teams share information so that monitoring, detection rules, and response procedures can be improved.
Red teaming does not replace routine penetration testing. It is most useful for organisations with established security controls that want to test their detection and response capabilities.
Agile and Continuous Penetration Testing
Traditional penetration testing takes place at a defined point in time.
Agile or continuous testing integrates security assessment more closely with software development and operational change.
Testing may take place:
- During development
- Before a software release
- After significant code changes
- Following infrastructure changes
- At scheduled intervals
- When new exposure is identified
This approach can reduce the period between introducing a vulnerability and discovering it.
Automated testing can provide frequent coverage, but human-led testing remains important for complex attack paths, business logic, contextual risk, and weaknesses requiring creative analysis.
Build and Configuration Reviews
Build and configuration reviews assess whether systems and security devices have been implemented securely.
Targets may include:
- Firewalls
- Routers
- Servers
- Cloud services
- Operating systems
- Identity platforms
- Databases
The review may identify weak settings, unnecessary services, excessive permissions, insecure rules, and departures from approved standards.
A configuration review is not always considered a penetration test because it may examine settings without actively exploiting them. However, it can identify weaknesses that would otherwise create exploitable attack paths.
Choosing the Right Type of Penetration Test
The right pentest type depends on the organisation’s assets, threat exposure, and security objectives.
For example:
- A customer portal may require web application and API testing
- A cloud migration may require cloud and identity testing
- A ransomware assessment may require external and internal network testing
- A new mobile service may require mobile application and API testing
- A mature security operations team may benefit from red-team exercises
- Concerns about employee impersonation may justify social engineering testing
Organisations should consider:
- Which systems are most critical
- Where sensitive information is stored
- Which services are exposed to the internet
- Which systems have recently changed
- Whether the main threat is external, internal, or supply-chain based
- Whether prevention, detection, or response is being tested
- Whether contractual or regulatory requirements apply
The scope should be based on risk rather than choosing a generic testing package.
How Often Should Testing Be Performed?
Many organisations conduct penetration testing at least annually, but the appropriate frequency depends on risk and the rate of technical change.
Additional testing may be needed:
- After significant infrastructure changes
- Before launching a major application
- Following a cloud migration
- After a serious security incident
- When access controls change
- When new compliance requirements apply
- When the organisation’s threat profile changes
High-risk or frequently changing environments may require more regular testing.
Building the Right Penetration Strategy
There is no single type of penetration test that can assess every security risk. Network, application, cloud, wireless, social engineering and other testing approaches each provide a different view of an organisation’s exposure, while black, white and grey box methods determine the perspective and depth of the assessment.
The most effective testing strategy therefore depends on the organisation’s critical assets, likely threats, technical environment and business objectives. Penetration testing should also form part of a wider security programme that includes vulnerability management, secure configuration, monitoring, employee awareness and incident response.
SeCore provides structured Penetration Testing services designed to identify exploitable weaknesses, demonstrate their potential impact and support practical remediation. By selecting the right testing approach and acting on the findings, organisations can gain a clearer understanding of their exposure and strengthen their defences against real-world attacks.
